A terminated assessor clerk still shows as active staff on notables because the identity lookup last refreshed before HR finished offboarding. What SIEM problem is that?
Select an answer to reveal the explanation.
Short Explanation
Asset and Identity is the SOC's employee directory glued onto every notable. If HR already walked that clerk out and the lookup still says active staff, every alert about that account is telling the wrong story. Dirty identity data is an investigation-quality problem, not a cosmetic one.
Full Explanation
Enterprise Security Asset and Identity lookups enrich notables with status, priority, category, owner, and business unit. A terminated clerk still marked active causes analysts to trust the wrong context and can mis-rank urgency. Timely HR or directory feeds and lookup refresh are SIEM hygiene, not optional polish. This is not an indexer-clustering failure, and identity fields are not merely decorative.